This is similar to the PR for BN012 that I submitted a little while ago. While that one checks for unreferenced TargetEndpoints, this one checks for unreferenced resources. Any files under the resources/ dir in the proxy bundle.

There are two ways a resource file can be used:

1. in the special policy type for the resource. Eg, an XSL policy will reference a resource with a path like resources/xsl/something.xsl, while an OASValidation policy will reference a resource with a path like resources/oas/something.yaml . And so on.
2. In AssignMessage/AssignVariable/ResourceURL . This element can reference any text-style resource.

Exceptions to these checks are:

1. java - Not possible to know whether a JavaCallout will use a JAR file.
2. properties - These are implicitly used, and it is not possible to check for any references to properties.

All other types of resource - jsc, py, xsl, wsdl xsd, oas, graphql - are checked.